The present invention relates to a method, a computer program and apparatus for analyzing symbols in a computer system.
There are many examples of computer systems in which it is useful to be able to analyze symbols passing through or stored in the computer system. As appreciated from the following, the term “symbols” in this context is to be construed broadly. In general, the term “symbols” is used herein in the broad sense as used in the field of Universal Turing Machines. For example, “symbols” includes computer messages, which term is also to be construed broadly and includes for example computer messages in a computer language (including computer instructions, such as executable programs), natural languages in computer-readable form (such as in documents, emails, etc.). “Symbols” also includes computer data in the conventional sense, i.e., typically, abstractions of real world artifacts, etc.
Individual computer messages entering into or passing through a computer system are often one element of a more complicated transaction that it is intended to be processed by the computer system. Such a transaction is also known as a “workflow”. The individual computer messages can be generated by for example an application (i.e. some computer software), typically at the instigation of a user, as part of an overall process or “workflow”. Such workflows are often business related.
The discovery, monitoring and control of workflow is beneficial in a number of domains, including but not limited to: security, operational effectiveness, metering and quality assessment. In the security domain, determining what are normal and expected workflows with sufficient accuracy allows the automated detection of anomalies. Anomalous workflows can be controlled in a number of ways. For example, they can be logged for later forensic analysis; they can trigger an alarm or alert so that immediate attention is given to them; they can be controlled by preventing them from being committed or terminated early; they can be redirected to alternative resources (e.g. as in load balancing); and they can be dynamically restructured to provide a more acceptable outcome. In the operational effectiveness domain, accurate determination of appropriate workflow can ensure that only the correct resources are used (e.g. workflows that do not interact with the correct information can be prevented from or redirected the appropriate resources); workflows that consume an undesirable proportion of resources (e.g. time, memory and/or power) can be identified and remediated; and workflows that include redundant operations can be recast into more effective workflows. In the metering domain, the accurate measurement of workflows provides non-repudiable evidence for accountancy (e.g. for charging in a pay-as-you-use manner). Last, workflows that have been effectively identified can be subjected to some quality criteria so that the developers of such workflows can understand and improve the workflows to a higher level of quality.